Phishing: significato, traduzione e definizione

Phishing is a cyber scam in which a criminal poses as a bank, a courier, a public body or a colleague to get hold of credentials, codes or money. Phishing can be stopped in three moves: recognise the message, protect accounts with phishing-resistant authentication, and know what to do in the first few minutes after a mistake.

Phishing does not attack software: it attacks a person who is in a hurry, trusts a familiar logo and has no time to check. That is why it works, and why it remains the preferred entry point for identity theft and corporate fraud. In 2025 the FBI received more than 191,000 complaints of phishing and spoofing, the most reported category of cybercrime in the United States (FBI, Internet Crime Report 2025). In Italy, CERT-AgID recorded 3,620 malicious campaigns targeting citizens and public administrations in the same year (CERT-AgID, Report 2025).

What is phishing?

Phishing is a form of online fraud in which a criminal poses as a trusted party, such as a bank, a courier, a public body, a company or a colleague, to persuade the victim to hand over confidential information or take a harmful action. The most sought-after information is login credentials, card details, OTP codes and personal data. Typical actions are clicking a link, opening an attachment, making a bank transfer or installing an app.

Phishing: what does it mean? The term is pronounced like the English word fishing. The “ph” in place of the “f” harks back to 1990s hacker slang. The analogy is that of a fraudster casting bait (a credible message) and waiting for someone to bite. There is no translation in common use in Italian, so even the Polizia Postale and CERT-AgID use the English term.

Note, however: phishing is not spam. Spam is unsolicited communication, often advertising. Phishing is deception aimed at stealing data or money. Nor is it malware, although it is often the gateway to it: many attacks are designed precisely to get malicious software installed.

Why is phishing such a successful fraud technique?

Phishing works because it exploits social engineering: the set of techniques that manipulate human behaviour rather than breaking into a computer system. Attackers play on predictable emotions such as urgency, fear, curiosity, a sense of duty or the lure of easy money. Their aim is for the victim to act before stopping to check.

For an attack to succeed, four conditions generally have to be met:

Then there is the economic factor. Email addresses and phone numbers are easy to obtain, sending thousands of messages costs next to nothing, and today there are ready-made phishing kits sold online as a service (so-called Phishing-as-a-Service). With these kits, even a criminal with no technical skills can clone a bank’s website in minutes.

Common examples of phishing attacks

• Emails reporting a problem with your account. The message appears to come from your bank or a service such as PayPal or Amazon, warns of suspicious activity or an imminent block and asks you to click to “verify” your details. In Italy, fake messages in the name of Poste Italiane, Intesa Sanpaolo and the other major banks are extremely common.
• Payment notices from public bodies. Fake fines, tax demands and tax refunds in the name of PagoPA, INPS or Agenzia delle Entrate. In 2025 CERT-AgID counted 328 PagoPA-themed campaigns based on fake traffic fines.
• Offers too good to be true. Prizes from competitions never entered, incredible discounts, investments with “guaranteed” returns, in exchange for a small upfront payment or personal data.
• Requests from colleagues or executives (spear phishing). The fraudster poses as a colleague, a manager or a supplier and asks for an urgent bank transfer, a change of IBAN or confidential documents.
• Messages on social media and WhatsApp. Malicious links from fake profiles or from friends’ accounts that have already been compromised, up to the fake messages from a “son who has changed his number” asking for money.
• SMS (smishing). Notices of a pending delivery or a blocked payment, with a link to “track” or “confirm” the details.

How can you recognise phishing emails?

Phishing emails almost always play on fear and urgency. The message claims that the account has been blocked, that a payment has failed or that action is needed within a few hours. The aim is to make the recipient do something immediately: click, fill in a form, open an attachment.

The most common malicious contents are three:

• Links to fake web pages. Sites identical to the originals in images, logos and fonts, built to capture usernames and passwords as soon as they are typed. Many use a valid HTTPS certificate, so the padlock in the address bar does not guarantee that the site is legitimate: it only indicates that the connection is encrypted.
• Malicious attachments. They look like invoices, receipts or shipping documents, but contain ransomware, keyloggers or trojans. The most common formats are PDFs with embedded links, Office documents asking you to “enable content”, .zip or .rar archives, .html files that open a fake login page and .iso disk images.
• Fake forms. They ask for phone numbers, card details, login codes or identity documents on bureaucratic pretexts.

The checklist for recognising a phishing attempt

Before clicking or replying, it is worth checking six elements:

1. The sender’s domain, not just the display name. The name may say “Poste Italiane” while the actual address is an unknown domain, with swapped characters (micros0ft.com) or added words (poste-assistenza-clienti.com).
2. The real link. On a computer, simply hover the mouse over the link without clicking. On a smartphone, press and hold to see the preview. Watch out for misleading subdomains: in paypal.com.verifica-account.xyz the real domain is verifica-account.xyz, not PayPal.
3. The type of request. Banks, Poste and public bodies never ask for passwords, PINs, OTP codes or full card numbers by email, text message or phone.
4. The tone. Extremely tight deadlines, threats of account suspension, unexpected prizes: urgency is the most consistent warning sign.
5. Personalisation. Generic phrases such as “Dear customer” are a clue, not proof. Targeted phishing uses the victim’s first name, surname and role.
6. Consistency with reality. Was the parcel really expected? Is the account really with that bank? Has the supplier ever changed its IBAN by email?

In phishing emails, grammatical errors and sloppy layout remain a useful clue, but an increasingly unreliable one: many messages are now written with artificial intelligence and are formally flawless.

Take a phishing email sent in the name of American Express. There are three giveaways: the sender does not use the company’s official domain, the recipient’s name is missing, and the text creates urgency to push the user towards a fake portal to “review” the account.

When in doubt, the rule stays the same: do not use the links or numbers in the message. Open the official app, type the website address manually or call the number shown on the card or on the official website.

The plausibility technique that makes us believe it could be true

In phishing, plausibility is everything. Copying a logo is no longer enough: the most effective attacks are credible in context, timing and behaviour. They arrive when the victim really is expecting a delivery, imitate a colleague’s writing style, and slip into an existing email thread.

Attackers study the routines of people and organisations: tax deadlines, sales periods, supplier payment dates, new digital services that citizens are still learning to use. And they exploit information asymmetries. Someone receiving a fine notice from PagoPA is unlikely to know what a genuine communication looks like, and the fraudster is counting on exactly that.

Plausibility also becomes technological. Adversary-in-the-middle (AiTM) techniques place a server between the victim and the real site. The user sees the genuine login page, enters their password and verification code, and the criminal intercepts the already authenticated session. This even bypasses two-factor authentication based on SMS or one-time codes.

How to protect yourself from phishing: technological measures

Before technology, the defence against phishing is training, both personally and at work. In organisations it must involve all employees, executives included, who are often the preferred target. Teaching people to recognise a phishing email is not enough: they need to know whom to report it to and what to do if they have already clicked.

Equally useful are phishing attack simulations run by IT administrators. They show who opens certain messages, which pretexts work best and which attachments most often catch people out. They also measure a valuable metric: how quickly people report the attempt.

On the technical side, companies can rely on email gateways that classify messages according to the reputation of senders and links. The most advanced systems use behavioural analysis and machine learning: they look for anomalies in traffic, open links in isolated environments (sandboxes) to check whether they trigger downloads or exploit vulnerabilities, and quarantine suspicious messages pending analysis.

Then there is an often overlooked layer: email domain authentication. The SPF, DKIM and DMARC protocols allow the recipient of a message to verify that it genuinely comes from the authorised servers of the stated domain. With a strict DMARC policy, messages posing as the company domain are rejected or quarantined. Since 2024 Google and Yahoo have required these protocols from bulk email senders (Google, Email sender guidelines). For a company, configuring them is the most direct way to prevent anyone from sending phishing in its name.

Beyond personal vigilance, there are tools and settings that offer additional protection:

• Multi-factor authentication (2FA/MFA). It should be enabled on every account that supports it, starting with email, banking, social media and e-commerce. Even if a criminal steals the password, without the second factor they cannot get in. But not all factors are equal: SMS codes are the weakest, because they can be intercepted or extracted over the phone; authenticator apps are better; passkeys and FIDO2 security keys are phishing-resistant, because they are cryptographically bound to the genuine domain and cannot be used on a cloned site.
• Antivirus and anti-malware software. Keep it up to date on computers, smartphones and tablets. Modern suites block known phishing sites, scan links and intercept malicious files before they are executed.
• Anti-spam and anti-phishing filters. Gmail, Outlook and other email services automatically block most fraudulent messages. It is worth checking that they are switched on and reporting as phishing any that get through: reporting improves the filter.
• System and software updates. Operating system, browser and apps must be kept up to date: many patches fix vulnerabilities exploited precisely after a click on a malicious link.
• Password manager. It generates unique passwords and fills in credentials only on the correct domain. If it does not offer to log you in on a site, that is a warning sign.
• Firewall. The operating system’s firewall must be active and configured to block suspicious traffic.
• Regular backups. In the event of ransomware, often delivered precisely through phishing, an up-to-date copy of your files means you do not have to choose between losing your data and paying a ransom.
• Reporting. Every attempt should be reported to the email provider, to the organisation being impersonated and, if necessary, to the authorities (we explain how further on).
• Methodical scepticism. No clicking on unexpected links, no opening unsolicited attachments, never sharing personal or financial details by email or message. If something seems too good to be true, it probably is.

Anti-phishing suites and digital identity protection

There is no one-size-fits-all protection against phishing. A security suite does not replace vigilance; rather, it blocks known sites, scans links and files, and limits the damage once the mistake has already been made, as we explained in our guide to anti-phishing tools.

• Norton 360. The range runs from AntiVirus Plus (one device, basic scam protection and a password manager) to Premium (up to 10 devices, 200 GB of cloud backup and Anti-Truffa Pro, which analyses messages to detect the manipulation typical of social engineering). The mid-range tiers add a VPN, useful on public Wi-Fi, and Dark Web Monitoring, which searches underground marketplaces for credentials that have already been compromised, so that passwords can be changed and cards blocked in time.
• Kaspersky. The three plans (Standard, Plus, Premium) use AI-based engines to detect even zero-day threats and protect online payments with an isolated browser. Plus adds a VPN and Data Leak Control, which checks whether your data appears in stolen databases; Premium focuses on digital identity and child protection.
• Avast. Premium Security and Ultimate offer comprehensive anti-phishing protection, intercepting counterfeit domains and deceptive emails at system level. Avast Secure Browser PRO, by contrast, only protects browsing within its own browser, not email or other applications.

Incogni: privacy protection

Antivirus suites act as a shield on the device and step in once the threat has already arrived. Incogni, by contrast, works upstream. It reduces the availability of email addresses, phone numbers and home addresses in the databases of data brokers, the companies that collect and resell information about people. In doing so, it deprives cybercriminals of the raw material they use to craft credible phishing and spear phishing attacks.

Its contribution against phishing is indirect, but tangible:

• Less spam and fewer scams. With less data in circulation, unwanted emails and aggressive sales calls decline, and in a cleaner inbox a phishing attempt stands out sooner.
• Harder spear phishing. Fraudsters obtain dates of birth, past addresses, habits and contacts from data brokers to build tailored messages. Without this data, profiling the victim costs far more.
• Lower risk of identity theft. Identity theft can be both the starting point and the result of a phishing attack. Less exposed data means less risk in either case.

The service automates work that, done manually, would mean contacting hundreds of companies. It relies on regulations such as the GDPR in Europe and the CCPA in California, which require data brokers to delete data on request: it periodically scans databases, sends the requests, tracks their outcome and provides monthly reports.

The strategies used by phishing criminals

Phishers continually refine their attack techniques. Social engineering remains the foundation, but channels, tools and the level of personalisation are changing. The Polizia Postale provides the overall picture: in 2025 it handled 27,085 proceedings for economic and financial cybercrime, with over 269 million euros stolen (Polizia Postale e per la Sicurezza Cibernetica, Annual Report 2025).

Impersonation and credibility

• Brand phishing. The most widespread strategy: impersonating well-known brands such as banks, streaming services, social networks and e-commerce sites (Amazon, Apple, Microsoft, Google, PayPal). Logos, graphics and language make the message hard to tell apart from the genuine one.
• Authority figures. Fraudsters pose as bank officials, public bodies (Agenzia delle Entrate, INPS, Poste Italiane), energy or telephone providers, executives, colleagues or IT technicians. Perceived authority discourages people from asking questions.
• Current events. News stories, tax deadlines, government bonuses, major sporting events or new platforms become pretexts for more credible and urgent lures.

Pressure tactics and emotional manipulation

• Urgency and fear. Locked accounts, suspicious logins, unpaid invoices, held-up deliveries: the victim must act quickly, without thinking.
• Greed and curiosity. Prizes, refunds, exclusive discounts, “safe” investments, or content designed to stimulate curiosity and an immediate click.
• Guilt and obligation. Fake fines, penalties or formal warnings push people to pay or hand over data to avoid alleged legal consequences.

Personalisation and research (spear phishing and whaling)

• Spear phishing. This is an attack targeting a specific person or organisation. Unlike mass campaigns, the fraudster studies the victim on social networks, LinkedIn and company websites, gathering name, role, interests and professional relationships. The result is a message that appears to come from someone the victim trusts: a colleague asking for a specific action, a supplier with an “urgent invoice”.
• Whaling. This is spear phishing aimed at an organisation’s “whales”: chief executives, finance directors, and senior managers with access to sensitive data or the authority to approve payments. The messages are meticulously crafted and imitate high-level internal communications.
• Business Email Compromise (BEC). This is the costliest evolution. The criminal joins a genuine email exchange, often from a compromised mailbox or a near-identical domain, and diverts a payment to an IBAN under their control. In 2025 alone, BEC fraud caused losses of over 3 billion dollars (FBI, Internet Crime Report 2025). For businesses, it is the underlying issue in the risks of cyber attacks and data breaches.

Diversified cyber attack vectors

Email is no longer the only channel and, in many cases, not even the most effective.

• Smishing (SMS phishing). On a smartphone the full URL is less visible, filters are less sophisticated and a text message feels more personal. Through sender-name spoofing, fake messages can appear in the same thread as genuine ones from the bank or courier.
• Vishing (voice phishing). Phone calls from fake bank staff, the “fraud prevention team” or supposed technicians, often from a spoofed number that looks like the bank’s. The typical aim is to get the victim to read out the OTP code or to persuade them to move their money into a “safe account”.
• Social media phishing. Direct messages, posts and fake profiles with deceptive links, or friends’ compromised accounts used to ask for money or to “vote” in a fake competition.
• Quishing (QR code phishing). Malicious QR codes in emails or on flyers, parking meters or fake fines, leading to a phishing site or a malware download.
• Pharming. Traffic is redirected from a legitimate site to a fake one without any click, by compromising DNS or through malware on the device.
• Evil Twin Wi-Fi. Fake hotspots that mimic legitimate networks in public places, to intercept the traffic of anyone who connects.

Advanced phishing attack techniques

• Clone phishing. The fraudster takes a legitimate email the victim has already received and sends it again almost unchanged, with links or attachments replaced by malicious versions, presenting it as an update or a correction.
• Counterfeit websites. Near-perfect copies of the originals, often with a valid HTTPS certificate. The addresses exploit typosquatting, i.e. plausible typing errors (amaz0n.it, intesasanpaolo-sicurezza.com), or misleading subdomains.
• Homograph attacks. They use characters from other alphabets identical to Latin ones, such as the Cyrillic “а” in place of “a”, to create addresses that are indistinguishable to the naked eye.
• Malicious attachments. PDFs, Office documents, ZIP archives or HTML files that, once opened, install ransomware, spyware or trojans.
• Adversary-in-the-middle. Phishing kits that act as intermediaries with the real site and steal the authenticated session, bypassing MFA based on SMS or one-time codes.
• ClickFix. Fake CAPTCHAs or error messages prompt users to copy and paste a command into their computer “to verify they are human”. It is the victims themselves who install the malware. In 2025 CERT-AgID recorded a significant rise in these attacks.
• TOAD (Telephone-Oriented Attack Delivery). An email with no links asks the recipient to call a number to cancel a subscription or a charge. On the phone, a fake operator talks the victim through installing remote-control software or handing over bank details.

The impact of artificial intelligence (AI) on phishing attacks

Artificial intelligence has lowered the cost of phishing and raised its quality:

• Flawless copy. Generative models write emails without errors, in the right tone and in any language. In an experiment by the IBM X-Force team, a generative AI produced in around 5 minutes a phishing email almost as effective as one a human team prepares in around 16 hours. The human one won by a narrow margin (IBM X-Force).
• Mass personalisation. Using AI and publicly available information, attackers generate thousands of messages tailored to each recipient’s role, interests and communication style.
• Audio and video deepfakes. A few seconds of recording are enough to clone a voice. The most frequently cited case is Arup’s: in 2024 an employee at the British group’s Hong Kong office authorised transfers of around 25 million dollars after a video call in which the chief financial officer and other colleagues were deepfake recreations (CNN).
• Fake websites in minutes. AI tools quickly generate realistic, fully working phishing pages.

In 2025, for the first time, the FBI classified AI-related crimes separately: more than 22,000 complaints, with losses of close to 900 million dollars (FBI, Internet Crime Report 2025).

What to do if you fall into the phishing trap

Falling for phishing does not mean you have lost everything. What matters is what happened after the click and how quickly you act. Here is what to do, depending on the situation.

I opened a phishing email but did not click

In the vast majority of cases, opening an email is not enough to compromise the device. At most, the sender learns that the address is active, if the message contains tracking images. Simply do not reply, report the message to the provider as phishing and delete it. It is worth disabling automatic loading of external images in the mail settings.

I clicked on the link but did not enter any data

Close the page immediately without filling anything in. Run a full scan with an up-to-date antivirus and check that no file has been downloaded: if the browser has downloaded something, delete it without opening it. In the following days, be especially careful with messages and calls that use the same pretext.

I have entered passwords or credentials

1. Change the password immediately for the affected account from a secure device, as well as for any other service where it had been reused.
2. Close active sessions from the account’s security settings (Google, Microsoft, Apple and the social networks all allow this).
3. Enable or strengthen multi-factor authentication, favouring authenticator apps or passkeys over SMS.
4. Check the mailbox rules: automatic forwarding or filters set up by the fraudster can hide messages from the bank.
5. Recover the social media account through the platform’s official procedure, without turning to profiles that promise to “unlock” it for a fee: they are almost always a second scam.

I have disclosed bank details or OTP codes, or authorised a payment

1. Call your bank immediately on the official number, the one on the back of the card or on its official website, to block the card, the account and any transactions in progress.
2. Dispute unauthorised transactions in writing, keeping receipts and bank statements.
3. File a report with the Polizia Postale or at any Police or Carabinieri station. The report is also needed for the refund claim.
4. Gather the evidence: screenshots of messages, texts, calling numbers, website addresses and times.

I downloaded an attachment or installed an app

Disconnect the device from the network and run a full scan. Uninstall any remote-control app or unknown software. Then, from another clean device, change your main passwords. On company devices, alert the IT department immediately, without switching off or formatting the computer, so as not to lose traces useful for the analysis.

How to report a phishing attempt

Reporting is worthwhile even if you did not fall into the trap, because it helps block the campaign before it reaches other people.

• Polizia Postale: via the Commissariato di PS Online portal, which collects reports and provides information on ongoing scams. To file a formal complaint, go to a Polizia Postale office or any police station.
• The impersonated organisation: banks, Poste Italiane and the main online services have dedicated channels, listed in the “security” sections of their official websites.
• The email provider or mobile operator: the “Report phishing” button in Gmail or Outlook, and blocking the sender’s number on the smartphone.
• At work: the IT department or security team, forwarding the original message as an attachment to preserve its technical headers.

What to do within a company: forensic analysis and containment

In a company, the response goes beyond the individual user. Using digital forensics tools, a forensic copy is made of the affected device and account, to reconstruct the emails, SMS messages or calls that led to the attack and identify the malicious element. The next step is to check for spyware or other malware installed after the link or attachment was opened, and to alert colleagues to the threat identified. Those managing suppliers and the supply chain will find more in cybersecurity in supplier contracts.

If the attack has exposed the personal data of customers or employees, a regulatory front opens too. The GDPR requires the breach to be notified to the Garante per la protezione dei dati personali within 72 hours of discovery, where there is a risk to the data subjects (EU Regulation 2016/679). Entities falling under the NIS2 framework also have specific obligations to notify significant incidents to the Agenzia per la Cybersicurezza Nazionale (ACN), via CSIRT Italia.

Data theft and phishing will remain a constant of digital innovation. What can be done is to combine ever more robust technical defences with people trained to recognise attacks and to respond well when something goes wrong.